Houston-based Memorial Hermann Health System paid the Health and Human Services Department's Office for Civil Rights $240,000 to settle a possible violation of the Health Insurance Portability and Accountability Act.
Memorial Hermann failed to respond to a patient's request for access to her health records in a "timely" manner, according to an HHS news release.
The disclosure from HHS came Friday as the office announced 11 more enforcement actions from its "Right of Access Initiative," launched in 2019 by the Trump administration. The initiative enforces HIPAA's requirement that patients must be able to access health records from healthcare providers and payers.
"Healthcare organizations should take note that there are now 38 enforcement actions in our Right of Access Initiative and understand that OCR is serious about upholding the law and peoples' fundamental right to timely access to their medical records," said Lisa Pino, director of the Office for Civil Rights, in the news release.
The settlement with Memorial Hermann, which also includes a corrective action plan, marks the largest of the 11 latest enforcement actions.
The Office for Civil Rights received a complaint from a patient in August 2020, alleging that Memorial Hermann had not shared copies of her records although she had made five requests between June 2019 and January 2020. The patient sought an itemized billing statement from the system's billing department.
Under HIPAA, providers typically have 30 days after receiving a request to supply a patient's health records.
After an investigation, the Office for Civil Rights determined that Memorial Hermann had not complied with the patient's request until March 2021.
As part of the corrective action plan, Memorial Hermann must revise internal policies and procedures related to patient access, develop new training materials for staff in its billing department, and share reports with the Office for Civil Rights on its progress, among other tasks.
The resolution agreement with the Office for Civil Rights is not an admission of liability.
"The Health Insurance Portability and Accountability Act (HIPAA) requires that requests for medical records be completed within a certain period of time," a Memorial Hermann spokesperson wrote in an emailed statement. "We regret that an unfortunate oversight prevented us from fulfilling this requirement."
The other 10 fines in the HHS office's latest announcement ranged from $3,500 to $100,000.
